System level access to Vista

[Trooper110]

Offensive Security Training

[{CLR}geneSW]

very interesting...

[Trooper110]

Only nice thing I see about that is that it appears to me at least, like you'd need to have physical access to the computer in order to really take advantage of that.

[DougBob]

Seems simple enough!

[Shazbot]

#1 I'd like to see them try to do that to a system that is on a domain.

#2 I'd like to try to see them do that to a system with drive encryprion like Authenex or some other commercial level drive encryption.

Things to remember:

Just about any OS can be hacked this way if there is physical access, no drive encryption and the security profiles are stored on the local machine. It's like leaving your car keys in your unlocked house. Anyone can walk in, take the keys and drive off in your car. What you need to do is lock the house (drive encryption) and keep the keys with you (having the machine on a domain).

[mapes]

#1 I'd like to see them try to do that to a system that is on a domain.

It looks like you need more than physical access to the machine. You need to find a machine with an active logged in administrator account. If the local domain user leaves they're machine logged in and has local administrators privileges it's possible. But big deal you already have root and could create a hidden user already so why bother?

#2 I'd like to try to see them do that to a system with drive encryprion like Authenex or some other commercial level drive encryption.

If the machine is already logged in the drive is therefore unencrypted and just as suceptable.

Things to remember:

Just about any OS can be hacked this way if there is physical access, no drive encryption and the security profiles are stored on the local machine. It's like leaving your car keys in your unlocked house. Anyone can walk in, take the keys and drive off in your car. What you need to do is lock the house (drive encryption) and keep the keys with you (having the machine on a domain).

Unlike the firewire hack which just requires physical access without rebooting this hack needs
a. A powered on machine
b. with a logged in privileged user

If you have that you don't need to install a utility you could create a user with a hidden ASCII character and you have root already with out a reboot.

The best thing to do is encrypt the drive with an encryption key that is stored on a USB flash drive. We you leave your system you pull the flash drive and the drive goes back to being encrypted gobbledegook.

[Shazbot]

I have yet to work in an IT shop that gives domain users local machine admin rights who don't have domain level admin rights. On top of that GPO can be made to prevent any new account creation on the local machine period.

So basically if the machine is on a domain that is activly managed this trick isn't going to work.

As for the drive encryption. They can boot off their live CD all they want, they won't be able to rename any files on the boot HD because of the encryption.

If you wanted to go a step further you could set a bios password, disable all other boot devices (remove them from boot order basically). Sure they could pop the battery and reset the CMOS but I think someone would notice them ripping the case cover off.

Basically tricks like these work on home PCs that are completely unprotected (and have nothing to protect really, no one wants your vacation photos).

[mapes]

You obviously have never worked in an engineering department. I do not have domain admin rights but I do have local machine admin rights to add printers and software. I've worked at Nokia and it was this way. I work at Blue Arc and it's this way. I've worked at Seagate (oh wait they didn't have domains back then) and I've worked at creative labs and it was this way. Almost any job where your not just pushing paper your given local administrator. I do totally agree with you though that this hack is kind a pointless however this one is not

Tool Physically Hacks Windows - Desktop Security News Analysis - Dark Reading

[Shazbot]

Actually I have and our developers were in their own, non-production domain on a separate network. Yes they had local admin rights but like that matters, you can't go anywhere on the network from their machines except to their test equipment.

I have worked for Fortune 500 financial companies. I have previously handled network security as a regional manager for over 22 offices that's including routers, firewalls, intrusion protection, enterprise patching, AV, policies and Risk and Governance. By that time I was out of regular day to day domain administration. We have Help Desk and Sys Admins for that stuff.

Edit: But seriously, lets drop the "my e-penis is bigger than yours". I have been around the block and back again.

[mapes]

Actually I have and our developers were in their own, non-production domain on a separate network. Yes they had local admin rights but like that matters, you can't go anywhere on the network from their machines except to their test equipment.

I have worked for Fortune 500 financial companies. I have previously handled network security as a regional manager for over 22 offices that's including routers, firewalls, intrusion protection, enterprise patching, AV, policies and Risk and Governance. By that time I was out of regular day to day domain administration. We have Help Desk and Sys Admins for that stuff.

Edit: But seriously, lets drop the "my e-penis is bigger than yours". I have been around the block and back again.

Ok I apologize. To the credit of Nokia they had three networks. Production net..MAC locked to production imaged machines from IT (with Tivoli blarrghh). Then they had an engineering network that spanned several sites and at each site they had NATed private engineering testbeds nets...To stop things like Ixia boxes or smartbit chassis from slamming the other nets. To get to your NATed nets from the general engineering net you'd have to go through a SSH host and port forward.

But back to e-penises

I used to test these

Our low end box

NOKIA CRYPTO CLUSTER VPN GATEWAY ~ CC500 (aukcja 160102380994) - Og?oszenia i aukcje eBay.pl

Then these


Crap Nokia/checkpoint boxes..

then these



Then a UMA box (cell GPRS encapsulated in GRE and then encapsulated in IPSec)

Then these



Good product ....crap company

and now this



High performance NAS head.....